Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 71AuthenticatingusersPreventingparametermanipulationProvidingsecureconfigurationHandlingexceptionsProtectingsensitive dataWebServerApplicationServerDatabaseServerBrowserFirewallWebApplicationApplicationsDatabaseProtectingsensitivedataPreventingsessionhijacking andcookie replayattacksValidatinginputAuthorizingusersAuditing andlogging activityandtransactionsAuthenticatingand authorizingupstreamidentitiesEncrypting orhashingsensitivedataFigure 4.1Web application design issuesThe design guidelines in this chapter are organized by application vulnerabilitycategory. Experience shows that poor design in these areas, in particular, leads tosecurity vulnerabilities. Table 4.1 lists the vulnerability categories, and for each onehighlights the potential problems that can occur due to bad design.Table 4.1 Web Application Vulnerabilities and Potential Problem Due to Bad DesignVulnerability CategoryInput ValidationPotential Problem Due to Bad DesignAttacks performed by embedding malicious strings in query strings,form fields, cookies, and HTTP headers. These include commandexecution, cross-site scripting (XSS), SQL injection, and bufferoverflow attacks.AuthenticationAuthorizationConfiguration ManagementIdentity spoofing, password cracking, elevation of privileges, andunauthorized access.Access to confidential or restricted data, tampering, and executionof unauthorized operations.Unauthorized access to administration interfaces, ability to updateconfiguration data, and unauthorized access to user accounts andaccount profiles.(continued)